The legislation authorizes the Virginia Information Technologies Agency (VITA) to recruit, vet, and deploy civilian volunteers as first responders to cyber incidents affecting public agencies. An advisory board would develop operational procedures and oversee the corps, which aims to provide rapid assistance to municipalities lacking dedicated cybersecurity resources.
The Department of Planning and Budget estimates implementation would cost approximately $410,000, primarily for establishing the advisory board and funding background checks through the Virginia State Police.
Feggans, a Democrat serving his second term, modeled the proposal after successful programs in Ohio, Michigan, and Wisconsin. These states have demonstrated that volunteer-based cyber defense units can expand security capacity without imposing substantial financial burdens on state budgets.
The delegate's interest in cybersecurity legislation stems from his experience as an intern in former Governor Terry McAuliffe's administration, where he researched potential policy measures to strengthen Virginia's digital defenses.
The current legislative push arrives as cyberattacks against local governments intensify nationwide. Tijay Chung, a computer science professor at Virginia Tech, describes municipalities as "soft targets" that increasingly attract sophisticated threat actors.
Hackers have shifted focus from hardened corporate networks to more vulnerable institutions including schools, hospitals, and local agencies that often lack funding for advanced security systems or round-the-clock monitoring teams. "In my opinion, hackers think that attacking localities are easy targets—low risk, high reward," Chung noted.
A previous version of the bill passed the General Assembly in 2024 during Feggans' freshman term, but former Governor Glenn Youngkin vetoed the measure, deeming it premature, costly, and legally ambiguous within Virginia's existing cybersecurity framework.
The rebuke temporarily halted momentum for the volunteer corps concept, though cybersecurity incidents have continued to affect Virginia communities in the interim.
The proposed legislation would establish a formal structure for harnessing private-sector expertise to supplement government resources. Volunteers would serve under VITA's direction, responding to requests from affected agencies and providing hands-on technical assistance during active incidents.
The advisory board would evaluate procedures for managing the corps, ensuring standardized approaches to recruitment, training, and deployment.
Implementation challenges center on balancing rigorous vetting with technical competence. Chung emphasized that credentials alone do not guarantee effectiveness against active ransomware attacks. "Real-world experience is crucial.
Conversely, some of the best white-hat hackers may not have a formal degree," he explained, urging VITA to balance bureaucratic requirements with genuine technical capability. The selection process must identify individuals who can perform under pressure while maintaining security protocols and confidentiality.
The proposal aligns with a broader trend of states expanding cyber volunteer initiatives as federal priorities shift. With over 77 cybersecurity bills introduced across states in 2025 alone, jurisdictions are increasingly shouldering responsibility for digital defense.
Six states currently operate active cyber corps programs, while others develop partnerships with university cybersecurity clinics and nonprofit volunteer networks. These community-powered programs deliver essential services to resource-constrained organizations, weaving a safety net that protects public infrastructure regardless of whether threats originate from nation-state actors or criminal enterprises.
Virginia already maintains substantial cyber defense capabilities through the 91st Cyber Brigade of the National Guard, which conducts annual exercises like Cyber Fortress involving over 250 participants from military, industry, and academic sectors.
The volunteer corps would complement these efforts by providing specialized civilian expertise during emergencies, rather than replacing existing military or state IT functions.
For the bill to advance, it must clear the House of Delegates before the February 18 crossover deadline, after which it would require Senate approval before reaching Governor Abigail Spanberger's desk.
The outcome will signal whether Virginia joins the growing coalition of states treating civilian cyber volunteers as integral components of their security infrastructure.
The debate reflects broader questions about workforce development and public-private collaboration in cybersecurity. As the Department of Defense faces a 10% vacancy rate in cyber positions—approximately 25,000 unfilled roles—states are exploring alternative pipelines for accessing specialized talent.
Volunteer corps programs offer pathways for skilled professionals to contribute to public service while maintaining private-sector careers, potentially strengthening the overall cybersecurity ecosystem.
Michigan's Cyber Civilian Corps, established in 2013, demonstrates the model's viability. The program maintains a roster of vetted technical experts who provide rapid response assistance during critical incidents.
Volunteers undergo background screening, sign confidentiality agreements, and commit to ongoing training and community service activities. The structure allows the state to scale response capacity beyond what permanent staff alone could manage, while offering volunteers opportunities for professional development and public service.
Legislative success in Virginia would represent recognition that cyber threats require innovative, collaborative responses.
As local governments face increasing risks with limited resources, volunteer-based models may prove essential for maintaining public trust and operational continuity in an era of persistent digital danger.
